Data processing addendum

This addendum is part of our terms of service. It applies when Vatsin Technology Solutions Pvt. Ltd. (“we”) processes personal data for a customer (“you”) through Vatsin. Under the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary and we are your Data Processor.

1. What it covers

• Whose data: your employees, former employees, candidates, contractors and anyone else whose data you put into Vatsin.
• What data: the kinds of data listed in section 3 of our privacy policy.
• Why: only to provide, secure and support the service for you.
• For how long: while your account is active, and then as section 8 says.

2. Your instructions

We process your personal data only on your instructions. These terms, the settings you choose in Vatsin and your requests to our support team are your instructions. If we think an instruction breaks the law, we will tell you.

3. Our people

Only staff who need access to run or support the service can reach your data, and they must keep it confidential. Our support team opens a company’s data only to help it. Every such visit is logged, and you can require your approval first.

4. Security

We keep reasonable security safeguards, as the DPDP Rules require. These include encryption of sensitive identity numbers, encryption in transit, access controls, two-step sign-in, separate data for every company, audit logs and backups. We report cyber security incidents to CERT-In within 6 hours of noticing them, and keep the logs of our systems in India for a rolling 180 days, as the CERT-In directions of 28 April 2022 require. Our security page has details.

5. Our service providers

You allow us to use the service providers listed in section 7 of our privacy policy. If we add or replace a provider that handles your personal data, we will update that list and tell your admins at least 15 days before. If you object on reasonable data protection grounds and we cannot resolve it, you can end the affected service, and we will refund the unused part of any period you paid for in advance. We remain responsible for our providers’ work.

6. Breaches

6.1 If Vatsin Technology Solutions Pvt. Ltd. becomes aware of a personal data breach affecting your personal data, it will notify you without undue delay and in any event within 24 hours. The notice will describe what is known at that time: the nature of the breach, the categories and approximate number of Data Principals and records concerned, the likely consequences, and the steps taken or proposed.

6.2 Within 72 hours of becoming aware, Vatsin Technology Solutions Pvt. Ltd. will give you a fuller report with the information then available, and will update it as further facts become known. It will give you the help you reasonably need to inform the Data Protection Board of India and the affected Data Principals under the DPDP Rules, 2025.

6.3 “Becoming aware” means Vatsin Technology Solutions Pvt. Ltd. has a reasonable degree of certainty that a security incident has led to a personal data breach. Vatsin Technology Solutions Pvt. Ltd.’s own report to CERT-In under the CERT-In Directions of 28 April 2022 does not depend on, and will not delay, its notice to you.

6.4 Notice is given to your security contact and admins by email and in the app. A notice is not an admission of fault.

7. Helping you

Through the features of Vatsin, or on request, we will help you answer requests from people about their data, and meet your own duties under the DPDP Act.

8. When the service ends

When your account ends, you can download your data for 30 days.

8.3 After the export window, Vatsin Technology Solutions Pvt. Ltd. deletes your personal data from the live service. Copies in backups are removed as backups are replaced. Where the DPDP Rules, 2025 (rule 8(3)) or CERT-In directions require it, Vatsin Technology Solutions Pvt. Ltd. keeps personal data and logs of processing for the minimum period required (currently one year from the processing; 180 days in India for system logs), secured and used only for the purposes those rules allow, and then erases them.

On request, we will confirm the deletion in writing.

9. Checks

Once a year, or after a breach, you may send us a reasonable written security questionnaire, and we will answer it. Any other audit needs both sides to agree in writing on its scope, timing and cost.

10. Where data is kept

We store your data in India. Some providers listed in our privacy policy may handle limited data outside India, as described there. We will not send it to a country the Government of India has restricted.

11. Liability

The limits on liability in our terms of service (section 16) also apply to this addendum. Claims from our breach of the security, confidentiality or personal-data duties in this addendum have the higher limit of 2 times the general cap (terms section 16.3).